Hacker News Reader

Comment by sneak | Hacker News Reader

Imagine if S3 did this. I don't like Amazon, but at least they are security professionals.

Ad tracking pixels in your object store dashboard is just clownshoes from a security engineering standpoint, over and above the fact that it's a slimy, dickhead move for a paid service.

View on HN

Using any third–party scripts is a big security and privacy failure.

It's possible to manage the chrome browser centrally via g suite, and push out DoH settings. I use this in conjunction with NextDNS to put all browsers organization-wide onto a single blocklist, and block the common tracker hosts (GA, GTM, Facebook's domains, et c).

It's not foolproof, but it would stop this.

If you’re using Chrome as your org-default browser you’re leaking so much data to Google I’d fix that first.

I know that many computer systems have to be certified or compliant with a spec to be used (HIPAA). Is there a possibility that such data being sent across the wire to a 3rd party would break such compliance?

It depends on the relationship the third party has with the 1st party.

https://github.com/truevault/hipaa-compliance-developers-gui... was on HN a week ago. It seemed to jive pretty well with our internal policies at the HIPAA compliant company I work for.

If you have patient info in file names, yep.

>Imagine if S3 did this.

Walmart CEO already did couple of years ago https://www.wsj.com/articles/wal-mart-to-vendors-get-off-ama...

slimy, dickhead move for a paid service

It is just a dumb mistake.

The thing is, even if it was a dumb mistake, it's one of those mistakes a company like Backblaze can't afford to make.

If they don't pay attention to stuff like this, then why should I trust them with anything at all? This isn't some minor oopsie, this is failing to deliver on their core product[1]:

Top Backblaze B2 Use Case Solutions

Backup & Archive

Store securely to the cloud incl. safeguarding data on VMs, servers, NAS, and computers

[1]: https://www.backblaze.com/b2/cloud-storage.html

Backblaze is not led by dumb people. This was a conscious decision that they made and the got caught. I used to recommend them to people and I never will again.

It 100% voluntary: https://twitter.com/backblaze/status/1373751015594356739

I believe the tracking is intentional; I also believe that sending the filenames as part of that is a dumb mistake.

A dumb mistake that leaks private information to a third party seems like good reason not to trust or use their service. For me, the idealogue, the fact they're sending any tracking data from the dash to Facebook is enough reason.

The tweet says "I even opted out of their tracking widget thing!" and yet it continues tracking. Major mess up.

Reply on news.ycombinator.com